1

I have the following setup:

enter image description here

All the nodes inside my cluster are talking to each other via 30303 port. When I want to talk to them, I'm using a Geth light client via HTTP JSON RPC port 8545.

Only the Geth light client here opens HTTP JSON RPC. All my nodes in the cluster doesn't open HTTP JSON RPC port. They only open 30303 port.

All nodes in my cluster and my Geth light client node shared the same genesis.json file. The enode address of all the nodes in the cluster are keep private and has not leaked to public yet.

So my question here is, what possible could go wrong with this setup in terms of security?

Could someone (a bad guy) do anything bad to my private blockchain cluster if I keep the 30303 port open to public?

Could they guess the content of the genesis.json file and the enode addresses?

Improve this question
4
  • I am not a security expert nor I have experience with light nodes, but I think that it may depend on the kind of interfaces that are enabled by JSON RPC. For instance, if the admin interface is enabled, the attacker could get all the information about the peers, or with web3 inspect the blocks' header (comprising the block number 0). You can also restrict the access to the port with "rpccorsdomain" option in geth
    – Briomkez
    Commented Nov 15, 2018 at 10:14
  • Only the Geth light client here opens HTTP JSON RPC. All my nodes in the cluster doesn't open HTTP JSON RPC port. They only open 30303 port.
    – Zulhilmi Zainudin
    Commented Nov 15, 2018 at 10:19
  • If I am not wrong the light client stores also the headers of the block (and only the body of the one in which they are interested). Moreover, the light client stores the contact information to at least one full node, otherwise it could not syncrhonize. It should depend on the services enabled, but maybe it is better to await the response of someone that is more informed than me :)
    – Briomkez
    Commented Nov 15, 2018 at 10:30
  • In the default configuration port 30303 is the p2p port used to exchange information with other nodes in the network, blocks, transactions, etc. If you want to remain in sync with mainnet you will have at least one node connected to the outside world using the p2p, if you have a private tesnet and do not want interaction with outside you can block that port.
    – Ismael ♦
    Commented Nov 16, 2018 at 16:35

0

Reset to default